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(U) The Analytical Work Role 

(U) This module will enable you to: 

• (TS//SI//NF)-ldentify how BR and PR/TT fit into the analytic workflow 

• (T S//SI//N F) Recognize how BR and PR/TT authorities apply to real-life scenarios 



( TS//S I //NF ) (OGC Attorney): Throughout the first five modules of our course, we have discussed the BR and PR/TT Orders and the policies and 
procedures NSA has implemented to provide reasonable assurance of compliance with the Orders. We also have looked at the community of people and 
the work roles that are involved across the Enterprise to support that aspect of the mission. 



( TS//S I //NF ) (HMC Character): This part of our trip is designed specifically for anyone working in an analytical role, or supervising staff in an analytical role, 
in support of the BR and PR/TT Bulk Metadata Programs. In particular we will discuss facets of BR and PR/TT that are of interest to analysts and HMCs. 
This module will enable you to: 

• (TS//SI//NF) Identify how BR and PR/TT fit into the analytic workflow 

• (IS//SI / /NF) Recognize how BR and PR/TT authorities apply to real-life scenarios 
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(TS//SI//NF) (Display introductory 
images/graphics pertinent to the Zazi 
story). 

(TS//SI//NF) Graphic showing the portfolio 
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highlighted. Possible video footage of the 
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(TS//S1//NF) (HMC Character): In Module 1, 
leverage multiple authorities and tools. CT tc 
focus of the BR and PR/TT Programs, NSA 

(TS//SI//NF) To illustrate how these various ; 
analytic workflow, we’ll step through the exa 


we mentioned that in order to gain comprehensive insight into a target’s activities, it is often necessary to 
argets have maintained an ongoing desire to conduct attacks within the United States. Given the unique U.S.- 
is able to fill collection gaps left by our other authorities. 

authorities can complement each other to fill critical gaps, as well as to show how BR and PR/TT fit into the 
mple of Najibullah Zazi and the New York subway plot. 
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( TS//S I //NF ) Graphic showing the portfolio 
of CT authorities with BR and PR/TT 
highlighted 



( TS//S I //NF ) (HMC Character): | 
external operations! — 
tasked the address to FAA 702 and reviewed the subsequent traffic on a regular basis. 



(IS//SI//NF ) In Fall of 2009, one particular piece of content collection obtained from FAA 702 revealed an email exchange between a Pakistan-based target 
and an unknown individual suggesting that an unspecified terrorist operation was about to take place. Within this email, the analyst also discovered what 
appeared to be a U.S. -based phone number that was missing the country code. 



Comment [al]: Graphic of 2 terrorists sending 
email to each other, show email indicating threat and 
containing a number without country code 
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NSA reported the suspicious activity and minimized U.S. phone number in a standard EGRAM. After 
receiving the unminimized U.S. phone number through NSA’s Identity Release process, the FBI learned that the user of the unknown email address and 
owner of the phone number was a Colorado-based individual named Najibullah Zazi. FBI immediately started an investigation into Zazi’s activities. 
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(IS 'tfSMffsIP) 




\U. S. person N ajibullah Zazi is the user ofi\ 

~ ” | \ According to SI G I NT reporting 

|| a Pakistan-based al-Qa'ida (AQ) facilitator ; I 



I received an email from NaiiDullan zazi on 6 




hhone number. 



(T S#SWNP) (HMC Character): Simultaneously, to gain a fuller picture of Zazi’s contacts, an NS A CT analyst submitted a RAS-approval reques t to an HMC 
on Zazi’s phone number and emai l address. Recall from Module 3 that, in order to meet the RAS standard, an identifier must be tied to specific^^l 

In this case, the analyst met the RAS standard by basing the l ^stifjc ation on the fact that Zazi was in direct 
communication with the Pakistan-based email address used by a member of ^HiHHpi^^p^hHBecause Zazi is a U.S. person, after the RAS 
requests on Zazi's identifiers were reviewed by an HMC, they were then sent to OGC, who performed a First Amendment review and gave the final 
approval. 



(TS/ASI //NF ) When considering RAS, analysts should remember to include just the basic facts needed with supporting documentation, as was done in the 
Zazi case, and not clutter the justification with excess information or documentation. 



Comment [a3]: Graphic of RAS icinpklc 

Comment [chr4]: With the RAS ‘template’ are 
we going to pull up the key items in text bubbles or a 
‘cloud’ ala the rainbow slide presentation? 
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( TS//S I //NF ) Graphic showing the portfolio 
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(U) Use screen shots to illustrate main 
points 



( TS//S I //NF ) (HMC Character): After the RAS requests were approved, using the BR and PR/TT modes of |^H^HCT analysts began running federated 
metadata queries on the approved identifiers, as we discussed in Module 4. The analyst querying Zaz^^olorad^Dhone number discovered that around 
the time that Zazi exchanged emails with the had also contacte^^^H^^^^^BDhone numbers. Using the 

MiiiiiiIii i i n unique to BR metadata. Based on 
we reviewed in Module 4. Before the report was 



guidance that we discussed in Module 4, the analyst determined that Zazi’s contacts with these I 
this uniqueness, the analyst began drafting a report in accordance with the dissemination guideli 
released, the Chief of SI 2 determined that the report met the CT Nexus criteria and approved its release. 



Comment [a5]: Use one of screenshots showing 
what a chain/query looks like 



{TS//SI//NF) Remember, even “fact of statements describing what BR- or PR/TT-unique data was discovered are considered “query results” under FISC 
guidelines a nd must be handled in accordance with the Court Orders. However, once formally disseminated to customers, it no longer requires the 
^^^^^MIP r °tection and is treated as normal SIGINT analysis, as is the case with the example we have just described. 
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(U) Knowledge Check 

1 . (TS//SI//NF) In the Zazi scenario, analysts used E.O. 12333 and FAA 702 collection to support RAS 
Which source(s) can be used to support RAS? 
a) (U) FBI reporting 


NEXT FRAME ID: 6081 


b) (U) Open sc 

c) (TS//SI//NF) 

d) (U) All the 

O /TC/(CI/(MC\ 


jurce information 
NSA FISA collection 

sources above can be used 

y was the RAS request for Zazi sent to OGC for a First Amendment review? 
► All RAS requests go to OGC fora First Amendment review 

\ Zazi is a U.S. person 

i Zazi is a member of al-Qa'ida or an associated terrorist group 
) The RAS determination was a close call 
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(U) (HMC Character): Let’s make a few notes 


in our travel journal and check to see what you remember from this topic! 


Question 1 (U//FQUQ) Correct! Any information that is lawfully in our possession may be used to support a RAS determination 
(UflfcQUQ) Incorrect, the correct answer is d). Any information that is lawfully in our possession may be used to support a RAS determination. 

Question 2. (U//FOUQ) Correct! A First Amendment review is only necessary when the identifier is believed to belong to a U.S. person. 

(U//FQUQ) Incorrect, the correct answer is b) A First Amendment review is only necessary when the identifier is believed to belong to a U.S. person. 
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3) ( TS//S I //NF ) In this scenario, information was discovered that was unique to the BR authority. If that same 
information had also been discovered in E.O. 12333 collection, a CT Nexus determination would still need to 
be made in order to disseminate that information because the information was in the BR repository. 

a) (U) True 

b) (U) False 

4) ( TS//S I //NF ) Why are students without allowed to learn that Zazi had contact with other New 

York numbers? 

a) ( TS//S I //NF ) That information is not specific enough to qualify 

b) ( TS//S I //NF ) The information is over one year old 

c) ( TS//S I // NP) The information has been previously disseminated outside of NSA 

d) (IS//SI / /NF) It is being shared for training purposes 



(No audio or transcript on this page) 



Question 3. (- T - S//S I //NF ) Correct! If the same information is discovered through another source, neither the BR nor PR/TT rules and requirements apply. 
(TS//S I //NF) Incorrect. The correct answer is b) (False). Neither the BR nor PR/TT rules and requirements apply if the same information is discovered 
through another source. 

Question 4. ( TS//S I //NF ) Correct! The information can be disclosed to those without | because it has previously been disseminated outside 

of NSA. 

( TS//S I //NF ) Incorrect. The correct answer is c). The information can be disclosed to those without because it has previously been 

disseminated outside of NSA. 
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(U) Practice Scenario 1 



(T S//S I //N E) You are a cleared analyst who, through PR/TT metadata analysis of seeds associated 
with a high value CT target, has identified a PR/TT-unique direct contact - email address|^||^|^KBK|| 
believed to be used by someone i n Yemen. You, are not sur e whether the identifier warrants further development as 
a target, but to find out you place a tasking database to enable content collection from 

E.O. 12333 sources. This tasking ’aafaEase is widely availaole to all intelligence analysts in the SIGINT Production 
Chain. For this reason, you note in the comments field that this identifier was discovered through metadata analysis 
and is believed to be a direct contact of the high value CT target, but you deliberately avoid identifying the PR/TT 
metadata as the source of the identifier. Are your actions in compliance with the terms of the PR/TT Orders? 

(U) Please select the your answer: 

a) (T S /Z- S t/Z N E) Yes, because you did not include the reference to PR/TT. 

b) (T S//S I //N F) No, because you failed to mark the source of the identifier as PR/TT metadata. 

c) {T S//S I //N E) Yes, because the results will be governed under E.O. 12333 rules and procedures. 

d) (TS//S I // NP} No, because you have shared a PR/TT-unique auer^jesul^ith a wide audience 
of intelligence analysts, many of whom do not hold currentf^m^^^pcredentials. 



(U) (HMC Character): Now let’s practice what we have learned using a real-life scenario. Carefully read the scenario and then select the best answer. 
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ANSWER: 

a) (T S//S I //N F) Incorrect. The correct answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of intelligence 
analysts, many of whom do not hold current |^^|^^^^^redentials. 

b) {T S//S + //N P) Incorrect. The correct answer i s d). No, becaus e you have shared a PR/TT-unique query result with a wide audience of intelligence 

analysts, many of whom do not hold current credentials. 

c) (T S//S I //N F) Incorrect. The correct answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of intelligence 

analysts, many of whom do not hold current credentials. 

d) (TS//S I // NE) Correct! The right answer is d). No, because you have shared a PR/TT-unique query result with a wide audience of 
intelligence analysts, many of whom do not hold current HHHUcredentials. 
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(U//FOUO) You should now be able to: 



Identify how BR and PR/TT fit into the analytic workflow 
' Practice applying BR and PR/TT authorities in real-life scenarios 

( TS//S I//NF) If you have questions or wish to find out more, please contact your] 
leared manager or any of the following BR or PR/TT points of contact: 



OGC email alias: DL gc_ops 

OGC Phone:^^^^^Hor 963-31 21 (s) 

OGC website: go GC 

HMCs email alias: DL CT HMC 



SID Oversight and Compliance email alias: DL SV42_all 



(U//F0U0) (HMC Character): Now that we have completed this part of our road trip, you should be able to: 

• ( TS//S I //NF ) Identify how BR and PR/TT fit into the analytic workflow 

• ( TS//S I //NF ) Practice applying BR and PR/TT authorities in a real-life scenario 



( TS//S I //NF ) (HMC Character): You are encouraged to reach out to vour ^^^^^^^^■ ciearea manager or any of the points of contact listed here if you 
have any questions or if you want to find out more. Please remember that it is critical to our mission that we are 1 00% compliant with the requirements in 
the Court Orders especially with regards to collaborating, sharing, and disseminating this data through the course of your analysis work. You may review 
this course at any time and seek guidance from any of the points of contact listed here. 
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(U) PLEASE READ: Important Assessment Information 

• (U) You will view the questions in a separate Assessment Questions Document 

NEXT FRAME ID:N/A 

• (U) You will enter your responses in a separate QuestionMark online answer sheet 



• (U) You will have only one attempt to successfully complete the assessment 



• (U) Allow yourself sufficient time (approximately 30 minutes) to complete the assessment 
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(U) To Complete the Assessment: 



• (U) Click the link to open the Assessment Questions Document 



• (U) Go to the VUport SumTotal Content Player page, click on the Assessment link, and follow the 

instructions to complete the required exam 



Comment [SLS6]: Please make rhi?. a link that, 
will open llu- Assessment Quo* * lion pdf lor 
Analytical Personnel (we will actually connect.t.he 
link lfcilcr\ 



(U //FQUQ ) (OGC Attorney): The final part of your trip will be to successfully complete the assessment for the course Please be aware that for the 
assessment you will view the questions in a .pdf file and enter your responses in a separate QuestionMark online answer sheet. Please be sure that you 
open the pdf with the questions first before opening the QuestionMark online answer sheet. You will have one attempt to complete the assessment. Please 
allow yourself sufficient time (approximately 30 minutes) to complete the assessment. 



(U //FOUO ) Please click the Assessment Questions Document link to open the .pdf question file and keep the window open. Then go to the VUport 
SumTotal Content Player page, click on the Assessment link on the left, and follow the instructions to complete the required exam 
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